On 1 January 2020, Russia will introduce a new, compulsory system for tracking pharmaceuticals from manufacturer to end user. This new legislation should be considered alongside wider global efforts to enhance quality control and provide protection against fake and counterfeit medicines. Recent reports evidence the devastating impact of counterfeit medicines around the world, making the need for fully traceable pharmaceuticals more relevant than ever before.
Although Russia’s approach to compulsory serialisation follows that of many other regions, there are technicalities and complications that are specific to Russian regulations that must be addressed by companies in the pharmaceutical supply chain … if they are to remain compliant next year.
Here, we explore the issues pertinent to organisations looking to commence or continue in the new Russian market, including some background on track and trace, reporting to Russian authorities, the new cryptographic approach and the challenging timeline faced by all parties involved.
An emerging global standard
First and foremost, the deadline is approaching quickly. Any organisations in the supply chain that have not yet started to investigate the changes required are unlikely to be prepared in time for the 1 January 2020 deadline.
There are many moving parts that need to come together to make this transition work, including the supply chain, IT structure, partner processes and product coding. Companies can build on what has been accomplished in other regions (such as the USA) but there are some issues and challenges that are specific to Russia.
The new legislation includes a full track-and-trace approach with item-level coding and aggregation. Track and trace as an approach is already in place in other regions of the world. It’s designed to make it more difficult for counterfeit drugs to enter the pharmaceutical supply chain and, if they do, the system makes it simpler for authorities to identify at what point they infiltrated the system.
These approaches in the EU, USA and other regions use 2D barcodes and randomised serial numbers on each individual pack. The authenticity of each pack is then verified by entering its unique identifier number into a repository system at the time of manufacture and checking the identifier against its entry in the system at one or more points in the supply chain.
Although there are many similarities, there are also many differences between track-and-trace requirements across different regions. We at Excellis Europe monitor these systematically and make this information available as our proprietary Regulatory Requirement Radar — a comprehensive and systematic overview of the existing and anticipated regulations.
Through this tool, we can analyse regulations region by region, identify trends and recognise exceptions against our benchmark that we describe as the Emerging Global Standard (EGS) in serialisation, covering the key areas such as coding standard, data carrier, data management and reporting.
Analysing the new Russian requirements against these Emerging Global Standards, it is clear that Russia presents significant exceptions, most notably the requirement for a cryptographic key to be included in the 2D data matrix. Also, in most markets, serialisation only applies to prescription drugs and not over-the-counter ones.
In Russia, all human medicines will need to be traceable from January 2020. Put simply, just because a company is currently compliant with other international regions, it does not automatically follow that it will be compliant with the new Russian legislation.
Reporting to Russian authorities
The process towards this new legislation in Russia first started in February 2017 when the pilot programme (Markirovka or IS MDLP) launched; and, arguably, to date, it has not received the sector attention that it deserves.
Different suppliers in this pilot programme are targeting the different objectives stated in the legislation, and some of the companies who started on the process in its early stages are already in a reasonable state of compliance with the legislation, including the complicated cryptographics.
These companies have clearly had a head start with the process change, but it proves that reaching compliance in a short timeframe is achievable. Companies that have not started their engagement, by contrast, are facing a tough challenge ahead of them.
The second milestone for the process was in December 2017 when Federal Law No. 425-FZ “On Amendments to the Federal Law” regarding the circulation of medical products was implemented. In November 2018, the management of the pilot moved to the public-private partnership CRPT and, later in December 2018, more specific laws and decrees came into force.
In Russia, the CRPT is equivalent to the European Medicines Verification Organisation (EMVO) in Europe, and we expect to see some of the same challenges in Russia as were seen in Europe in terms of timelines and changes to legislation.
Looking specifically at Europe, in the three years between the publication of the regulation and it coming into force, there were 13 sets of “questions and answers” and various aspects of the legislation shifted in that time. Although the process of implementation in Russia is likely to be more top-down, there will remain some shifting dynamics regarding the practical application of the requirements.
Another issue for companies facing the new legislation is the language barrier; non-native companies are required to fully understand and respond to complicated legislation and laws in Russian. This matter is not always given the full attention that it needs. There is a complex lexicon being used and companies must ensure that the intricacies of the new law are not lost in translation.
However, there is some good news for companies that will have products on the market before 1 January 2020; any items released to market prior to that date do not need to comply with the new requirement. Companies may choose to release products to market before January 2020 to delay their transition to the new legislation.
Those who choose this route will need to do a cost-benefit analysis, as the expiration date of medicines will affect how long these products can be in the supply chain.
Cryptographic approach
The cryptographic approach to serialisation is one of the most noteworthy aspects of the new Russian legislation. So, how is this different from the EU FMD? Since February 2019, all new packs of prescription medicines put on the market must have two safety features: a unique identifier (UI) and an antitampering device.
The barcode allows each pack to be serialised with a unique randomised number, which is authenticated before dispensing. This identification data is stored in a database managed by the EMVO and supported at national level. Manufacturers check packs into the database and they are authenticated, decommissioned or “checked out” in the pharmacy by scanning the barcode. This sends a message to the database, which then considers the authenticity of that pack, sending confirmation back to the pharmacy.
The new Russian legislation takes one large step further. Russia is adopting a cryptographic approach whereby every serial number, generated by the manufacturer, is paired with a second set of codes that encrypt the original serial number, generated centrally. This means that there is an additional need for serial number exchange with the authorities, alongside the internal serial number exchange with the site/serialisation equipment or contract manufacturer.
There are several benefits to this new cryptographic system compared with the EU-FMD model — it enables offline authentication by a black box using a secret algorithm and provides unequivocal authentication without the need for a database or Internet access. But, it also presents two challenges: a bigger code and the additional data exchange.
Manufacturers will generate serial numbers and these need to be uploaded to the cryptoserver. For every serial number, the cryptographic elements are issued a key signature. They need to be downloaded again by the manufacturer and applied in the data matrix to every pack that is put on the market.
Plus, the cryptographics are reported on numerous occasions along the distribution line. The cryptographic codes are significantly larger than those in Europe — nearly doubling in symbol size. In terms of production, this directly affects the size of the label … but there may also be printing capability implications.
Not all production lines will be able to print the code size and resolution required; there may also be line speed, vision and aggregation system issues as well. Case packing stations need to be assessed as soon as possible to ensure that they can operate within these new circumstances.
Unlike the EU FMD, there are no antitamper requirements in Russia. Despite this, we would recommend that companies do employ antitamper mechanisms to protect their product and, ultimately, their patients. The cryptocode brings several requirements that your current EU FMD and DCSCA capability will be pushed to provide.
One is that data exchange is something that must be looked at very closely. Secondly, being able to manage aggregation is now a “must have” as opposed to a “nice to have” for EU FMD compliance.
Timeline and processes
Russia is demanding full traceability throughout the pharmaceutical supply chain by January 2020. Multiple events must be captured across the entire supply chain to be reported to the MDLP; for some products, 50 or more transactions need to be monitored and recorded. To understand what is happening at each stage in a supply chain, an in-depth analysis is needed, including clarification of where the obligations for reporting lie and which parts of the chain need to be involved.
This development is indicative of a larger objective; this new reporting structure will provide a lot more information and visibility to the Russian government. This pharmaceutical initiative sits alongside other areas of the supply chain beyond medicine, such as tobacco and some luxury goods, which are already covered by similar requirements and we expect to see this evolve with time into many other sectors.
Russia is being watched very closely by the Eurasian market and there is a possibility that this model will be adopted in other regions.
Potentially, getting ready for Russia will help to secure your supply chain, sales potential and success for other markets in the future.
If you currently import into Russia, or plan to, item level serialisation, cryptocode exchange and additional reporting are challenges that must be addressed as soon as possible to meet the January 2020 deadline. Significant changes are required as this is unlike anything that has gone before.
However, with the proper analysis and a holistic approach to assessing all elements in the supply chain, you can make sure that your organisation can continue to operate and, indeed, prosper within this growing market.